Blame SOURCES/ghostscript-cve-2019-3835.patch

483aca
From 779664d79f0dca77dbdd66b753679bfd12dcbbad Mon Sep 17 00:00:00 2001
483aca
From: Chris Liddell <chris.liddell@artifex.com>
483aca
Date: Mon, 26 Nov 2018 18:01:25 +0000
483aca
Subject: [PATCH 1/4] Have gs_cet.ps run from gs_init.ps
483aca
483aca
Previously gs_cet.ps was run on the command line, to set up the interpreter
483aca
state so our output more closely matches the example output for the QL CET
483aca
tests.
483aca
483aca
Allow a -dCETMODE command line switch, which will cause gs_init.ps to run the
483aca
file directly.
483aca
483aca
This works better for gpdl as it means the changes are made in the intial
483aca
interpreter state, rather than after initialisation is complete.
483aca
483aca
This also means adding a definition of the default procedure for black
483aca
generation and under color removal (rather it being defined in-line in
483aca
.setdefaultbgucr
483aca
483aca
Also, add a check so gs_cet.ps only runs once - if we try to run it a second
483aca
time, we'll just skip over the file, flushing through to the end.
483aca
---
483aca
 Resource/Init/gs_cet.ps  | 11 ++++++++++-
483aca
 Resource/Init/gs_init.ps | 13 ++++++++++++-
483aca
 2 files changed, 22 insertions(+), 2 deletions(-)
483aca
483aca
diff --git a/Resource/Init/gs_cet.ps b/Resource/Init/gs_cet.ps
483aca
index d3e1686..75534bb 100644
483aca
--- a/Resource/Init/gs_cet.ps
483aca
+++ b/Resource/Init/gs_cet.ps
483aca
@@ -1,6 +1,11 @@
483aca
 %!PS
483aca
 % Set defaults for Ghostscript to match Adobe CPSI behaviour for CET
483aca
 
483aca
+systemdict /product get (PhotoPRINT SE 5.0v2) readonly eq
483aca
+{
483aca
+  (%END GS_CET) .skipeof
483aca
+} if
483aca
+
483aca
 % do this in the server level so it is persistent across jobs
483aca
 //true 0 startjob not {
483aca
   (*** Warning: CET startup is not in server default) = flush
483aca
@@ -25,7 +30,9 @@ currentglobal //true setglobal
483aca
 
483aca
 /UNROLLFORMS true def
483aca
 
483aca
-{ } bind dup
483aca
+(%.defaultbgrucrproc) cvn { } bind def
483aca
+
483aca
+(%.defaultbgrucrproc) cvn load dup
483aca
 setblackgeneration
483aca
 setundercolorremoval
483aca
 0 array cvx readonly dup dup dup setcolortransfer
483aca
@@ -109,3 +116,5 @@ userdict /.smoothness currentsmoothness put
483aca
 % end of slightly nasty hack to give consistent cluster results
483aca
 
483aca
 //false 0 startjob pop		% re-enter encapsulated mode
483aca
+
483aca
+%END GS_CET
483aca
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
483aca
index a2503f1..9a1f2b2 100644
483aca
--- a/Resource/Init/gs_init.ps
483aca
+++ b/Resource/Init/gs_init.ps
483aca
@@ -1534,10 +1534,18 @@ setpacking
483aca
   % any-part-of-pixel rule.
483aca
   0.5 .setfilladjust
483aca
 } bind def
483aca
+
483aca
 % Set the default screen and BG/UCR.
483aca
+% We define the proc here, rather than inline in .setdefaultbgucr
483aca
+% for the benefit of gs_cet.ps so jobs that do anything that causes
483aca
+% .setdefaultbgucr to be called will still get the redefined proc
483aca
+% in gs_cet.ps
483aca
+(%.defaultbgrucrproc) cvn { pop 0 } def
483aca
+
483aca
 /.setdefaultbgucr {
483aca
   systemdict /setblackgeneration known {
483aca
-    { pop 0 } dup setblackgeneration setundercolorremoval
483aca
+    (%.defaultbgrucrproc) cvn load dup
483aca
+    setblackgeneration setundercolorremoval
483aca
   } if
483aca
 } bind def
483aca
 /.useloresscreen {	% - .useloresscreen <bool>
483aca
@@ -2506,4 +2514,7 @@ WRITESYSTEMDICT {
483aca
 % be 'true' in some cases.
483aca
 userdict /AGM_preserve_spots //false put
483aca
 
483aca
+systemdict /CETMODE .knownget
483aca
+{ { (gs_cet.ps) runlibfile } if } if
483aca
+
483aca
 % The interpreter will run the initial procedure (start).
483aca
-- 
483aca
2.20.1
483aca
483aca
483aca
From e8acf6d1aa1fc92f453175509bfdad6f2b12dc73 Mon Sep 17 00:00:00 2001
483aca
From: Nancy Durgin <nancy.durgin@artifex.com>
483aca
Date: Thu, 14 Feb 2019 10:09:00 -0800
483aca
Subject: [PATCH 2/4] Undef /odef in gs_init.ps
483aca
483aca
Made a new temporary utility function in gs_cet.ps (.odef) to use instead
483aca
of /odef.  This makes it fine to undef odef with all the other operators in
483aca
gs_init.ps
483aca
483aca
This punts the bigger question of what to do with .makeoperator, but it
483aca
doesn't make the situation any worse than it already was.
483aca
---
483aca
 Resource/Init/gs_cet.ps  | 10 ++++++++--
483aca
 Resource/Init/gs_init.ps |  1 +
483aca
 2 files changed, 9 insertions(+), 2 deletions(-)
483aca
483aca
diff --git a/Resource/Init/gs_cet.ps b/Resource/Init/gs_cet.ps
483aca
index 75534bb..dbc5c4e 100644
483aca
--- a/Resource/Init/gs_cet.ps
483aca
+++ b/Resource/Init/gs_cet.ps
483aca
@@ -1,6 +1,10 @@
483aca
 %!PS
483aca
 % Set defaults for Ghostscript to match Adobe CPSI behaviour for CET
483aca
 
483aca
+/.odef {		% <name> <proc> odef -
483aca
+  1 index exch .makeoperator def
483aca
+} bind def
483aca
+
483aca
 systemdict /product get (PhotoPRINT SE 5.0v2) readonly eq
483aca
 {
483aca
   (%END GS_CET) .skipeof
483aca
@@ -93,8 +97,8 @@ userdict /.smoothness currentsmoothness put
483aca
    } {
483aca
      /setsmoothness .systemvar /typecheck signalerror
483aca
    } ifelse
483aca
-} bind odef
483aca
-/currentsmoothness { userdict /.smoothness get } bind odef % for 09-55.PS, 09-57.PS .
483aca
+} bind //.odef exec
483aca
+/currentsmoothness { userdict /.smoothness get } bind //.odef exec % for 09-55.PS, 09-57.PS .
483aca
 
483aca
 % slightly nasty hack to give consistent cluster results
483aca
 /ofnfa systemdict /filenameforall get def
483aca
@@ -113,6 +117,8 @@ userdict /.smoothness currentsmoothness put
483aca
   } ifelse
483aca
   ofnfa
483aca
 } bind def
483aca
+
483aca
+currentdict /.odef undef
483aca
 % end of slightly nasty hack to give consistent cluster results
483aca
 
483aca
 //false 0 startjob pop		% re-enter encapsulated mode
483aca
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
483aca
index 9a1f2b2..e5678b9 100644
483aca
--- a/Resource/Init/gs_init.ps
483aca
+++ b/Resource/Init/gs_init.ps
483aca
@@ -2253,6 +2253,7 @@ SAFER { .setsafeglobal } if
483aca
   /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
483aca
   /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath /.currentoutputdevice
483aca
   /.type /.writecvs /.setSMask /.currentSMask /.needinput /.countexecstack /.execstack /.applypolicies
483aca
+  /odef
483aca
 
483aca
   % Used by a free user in the Library of Congress. Apparently this is used to
483aca
   % draw a partial page, which is then filled in by the results of a barcode
483aca
-- 
483aca
2.20.1
483aca
483aca
483aca
From 205591753126802da850ada6511a0ff8411aa287 Mon Sep 17 00:00:00 2001
483aca
From: Ray Johnston <ray.johnston@artifex.com>
483aca
Date: Thu, 14 Feb 2019 10:20:03 -0800
483aca
Subject: [PATCH 3/4] Fix bug 700585: Restrict superexec and remove it from
483aca
 internals and gs_cet.ps
483aca
483aca
Also while changing things, restructure the CETMODE so that it will
483aca
work with -dSAFER. The gs_cet.ps is now run when we are still at save
483aca
level 0 with systemdict writeable. Allows us to undefine .makeoperator
483aca
and .setCPSImode internal operators after CETMODE is handled.
483aca
483aca
Change previous uses of superexec to using .forceput (with the usual
483aca
.bind executeonly to hide it).
483aca
---
483aca
 Resource/Init/gs_cet.ps   | 39 ++++++++++++++-------------------------
483aca
 Resource/Init/gs_dps1.ps  |  2 +-
483aca
 Resource/Init/gs_fonts.ps |  8 ++++----
483aca
 Resource/Init/gs_init.ps  | 38 +++++++++++++++++++++++++++-----------
483aca
 Resource/Init/gs_ttf.ps   |  6 +++---
483aca
 Resource/Init/gs_type1.ps |  6 +++---
483aca
 6 files changed, 52 insertions(+), 47 deletions(-)
483aca
483aca
diff --git a/Resource/Init/gs_cet.ps b/Resource/Init/gs_cet.ps
483aca
index dbc5c4e..58da404 100644
483aca
--- a/Resource/Init/gs_cet.ps
483aca
+++ b/Resource/Init/gs_cet.ps
483aca
@@ -1,37 +1,28 @@
483aca
-%!PS
483aca
 % Set defaults for Ghostscript to match Adobe CPSI behaviour for CET
483aca
 
483aca
-/.odef {		% <name> <proc> odef -
483aca
-  1 index exch .makeoperator def
483aca
-} bind def
483aca
-
483aca
+% skip if we've already run this -- based on fake "product"
483aca
 systemdict /product get (PhotoPRINT SE 5.0v2) readonly eq
483aca
 {
483aca
   (%END GS_CET) .skipeof
483aca
 } if
483aca
 
483aca
-% do this in the server level so it is persistent across jobs
483aca
-//true 0 startjob not {
483aca
-  (*** Warning: CET startup is not in server default) = flush
483aca
-} if
483aca
+% Note: this must be run at save level 0 and when systemdict is writeable
483aca
+currentglobal //true setglobal
483aca
+systemdict dup dup dup
483aca
+/version (3017.102) readonly .forceput         % match CPSI 3017.102
483aca
+/product (PhotoPRINT SE 5.0v2) readonly .forceput      % match CPSI 3017.102
483aca
+/revision 0 put                        % match CPSI 3017.103 Tek shows revision 5
483aca
+/serialnumber dup {233640} readonly .makeoperator .forceput % match CPSI 3017.102 Tek shows serialnumber 1401788461
483aca
+
483aca
+systemdict /.odef {           % <name> <proc> odef -
483aca
+  1 index exch //.makeoperator def
483aca
+} .bind .forceput          % this will be undefined at the end
483aca
 
483aca
 300 .sethiresscreen	% needed for language switch build since it
483aca
                         % processes gs_init.ps BEFORE setting the resolution
483aca
 
483aca
 0 array 0 setdash % CET 09-08 wants local setdash
483aca
 
483aca
-currentglobal //true setglobal
483aca
-
483aca
-{
483aca
-  systemdict dup dup dup
483aca
-  /version (3017.102) readonly put		% match CPSI 3017.102
483aca
-  /product (PhotoPRINT SE 5.0v2) readonly put	% match CPSI 3017.102
483aca
-  /revision 0 put			% match CPSI 3017.103 Tek shows revision 5
483aca
-  /serialnumber dup {233640} readonly .makeoperator put % match CPSI 3017.102 Tek shows serialnumber 1401788461
483aca
-  systemdict /deviceinfo undef                  % for CET 20-23-1
483aca
-%  /UNROLLFORMS true put                 % CET files do unreasonable things inside forms
483aca
-} 1183615869 internaldict /superexec get exec
483aca
-
483aca
 /UNROLLFORMS true def
483aca
 
483aca
 (%.defaultbgrucrproc) cvn { } bind def
483aca
@@ -118,9 +109,7 @@ userdict /.smoothness currentsmoothness put
483aca
   ofnfa
483aca
 } bind def
483aca
 
483aca
-currentdict /.odef undef
483aca
-% end of slightly nasty hack to give consistent cluster results
483aca
-
483aca
-//false 0 startjob pop		% re-enter encapsulated mode
483aca
+systemdict /.odef .undef
483aca
 
483aca
+% end of slightly nasty hack to give consistent cluster results
483aca
 %END GS_CET
483aca
diff --git a/Resource/Init/gs_dps1.ps b/Resource/Init/gs_dps1.ps
483aca
index b75ea14..01475ac 100644
483aca
--- a/Resource/Init/gs_dps1.ps
483aca
+++ b/Resource/Init/gs_dps1.ps
483aca
@@ -85,7 +85,7 @@ level2dict begin
483aca
                 % definition, copy it into the local directory.
483aca
       //systemdict /SharedFontDirectory .knownget
483aca
        { 1 index .knownget
483aca
-          { //.FontDirectory 2 index 3 -1 roll { put } systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse } % readonly
483aca
+          { //.FontDirectory 2 index 3 -1 roll .forceput } % readonly
483aca
          if
483aca
        }
483aca
       if
483aca
diff --git a/Resource/Init/gs_fonts.ps b/Resource/Init/gs_fonts.ps
483aca
index 01eca35..ab062e1 100644
483aca
--- a/Resource/Init/gs_fonts.ps
483aca
+++ b/Resource/Init/gs_fonts.ps
483aca
@@ -512,11 +512,11 @@ buildfontdict 3 /.buildfont3 cvx put
483aca
                 % the font in LocalFontDirectory.
483aca
    .currentglobal
483aca
     { //systemdict /LocalFontDirectory .knownget
483aca
-       { 2 index 2 index { .growput } systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse }	% readonly
483aca
+       { 2 index 2 index .forceput }	% readonly
483aca
       if
483aca
     }
483aca
    if
483aca
-   dup //.FontDirectory 4 -2 roll { .growput } systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse	% readonly
483aca
+   dup //.FontDirectory 4 -2 roll .forceput % readonly
483aca
                 % If the font originated as a resource, register it.
483aca
    currentfile .currentresourcefile eq { dup .registerfont } if
483aca
    readonly
483aca
@@ -1178,13 +1178,13 @@ currentdict /.putgstringcopy .forceundef
483aca
           //.FontDirectory 1 index known not {
483aca
             2 dict dup /FontName 3 index put
483aca
             dup /FontType 1 put
483aca
-            //.FontDirectory 3 1 roll { put } systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse   % readonly
483aca
+            //.FontDirectory 3 1 roll //.forceput exec % readonly
483aca
           } {
483aca
             pop
483aca
           } ifelse
483aca
         } forall
483aca
       } forall
483aca
-    }
483aca
+    } executeonly	% hide .forceput
483aca
 FAKEFONTS { exch } if pop def   % don't bind, .current/setglobal get redefined
483aca
 
483aca
 % Install initial fonts from Fontmap.
483aca
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
483aca
index e5678b9..a054222 100644
483aca
--- a/Resource/Init/gs_init.ps
483aca
+++ b/Resource/Init/gs_init.ps
483aca
@@ -2184,9 +2184,6 @@ SAFER { .setsafeglobal } if
483aca
   /.endtransparencygroup     % transparency-example.ps
483aca
   /.setdotlength             % Bug687720.ps
483aca
   /.sort /.setdebug /.mementolistnewblocks /getenv
483aca
-
483aca
-  /.makeoperator /.setCPSImode              % gs_cet.ps, this won't work on cluster with -dSAFER
483aca
-
483aca
   /unread
483aca
   ]
483aca
   {systemdict exch .forceundef} forall
483aca
@@ -2266,7 +2263,6 @@ SAFER { .setsafeglobal } if
483aca
 
483aca
   % Used by our own test suite files
483aca
   %/.fileposition %image-qa.ps
483aca
-  %/.makeoperator /.setCPSImode % gs_cet.ps
483aca
 
483aca
   % Either our code uses these in ways which mean they can't be undefined, or they are used directly by
483aca
   % test files/utilities, or engineers expressed a desire to keep them visible.
483aca
@@ -2471,6 +2467,16 @@ end
483aca
 /vmreclaim where
483aca
  { pop NOGC not { 2 .vmreclaim 0 vmreclaim } if
483aca
  } if
483aca
+
483aca
+% Do this before systemdict is locked (see below for additional CETMODE setup using gs_cet.ps)
483aca
+systemdict /CETMODE .knownget {
483aca
+  {
483aca
+    (gs_cet.ps) runlibfile
483aca
+  } if
483aca
+} if
483aca
+systemdict /.makeoperator .undef	% must be after gs_cet.ps
483aca
+systemdict /.setCPSImode .undef		% must be after gs_cet.ps
483aca
+
483aca
 DELAYBIND not {
483aca
   systemdict /.bindnow .undef       % We only need this for DELAYBIND
483aca
   systemdict /.forcecopynew .undef	% remove temptation
483aca
@@ -2479,16 +2485,29 @@ DELAYBIND not {
483aca
   systemdict /.forceundef .undef	% ditto
483aca
 } if
483aca
 
483aca
-% Move superexec to internaldict if superexec is defined.
483aca
-systemdict /superexec .knownget {
483aca
-  1183615869 internaldict /superexec 3 -1 roll put
483aca
-  systemdict /superexec .undef
483aca
+% Move superexec to internaldict if superexec is defined. (Level 2 or later)
483aca
+systemdict /superexec known {
483aca
+  % restrict superexec to single known use by PScript5.dll
483aca
+  % We could do this only for SAFER mode, but internaldict and superexec are
483aca
+  % not very well documented, and we don't want them to be used.
483aca
+  1183615869 internaldict /superexec {
483aca
+    2 index /Private eq                % first check for typical use in PScript5.dll
483aca
+    1 index length 1 eq and    % expected usage is: dict /Private <value> {put} superexec
483aca
+    1 index 0 get systemdict /put get eq and
483aca
+    {
483aca
+      //superexec exec         % the only usage we allow
483aca
+    } {
483aca
+      /superexec load /invalidaccess signalerror
483aca
+    } ifelse
483aca
+  } bind cvx executeonly put
483aca
+  systemdict /superexec .undef % get rid of the dangerous (unrestricted) operator
483aca
 } if
483aca
 
483aca
 %% Can't remove this one until the last minute :-)
483aca
 DELAYBIND not {
483aca
 systemdict /.undef .undef
483aca
 } if
483aca
+
483aca
 WRITESYSTEMDICT {
483aca
    SAFER {
483aca
        (\n *** WARNING - you have selected SAFER, indicating you want Ghostscript\n) print
483aca
@@ -2515,7 +2534,4 @@ WRITESYSTEMDICT {
483aca
 % be 'true' in some cases.
483aca
 userdict /AGM_preserve_spots //false put
483aca
 
483aca
-systemdict /CETMODE .knownget
483aca
-{ { (gs_cet.ps) runlibfile } if } if
483aca
-
483aca
 % The interpreter will run the initial procedure (start).
483aca
diff --git a/Resource/Init/gs_ttf.ps b/Resource/Init/gs_ttf.ps
483aca
index 05943c5..996d1e2 100644
483aca
--- a/Resource/Init/gs_ttf.ps
483aca
+++ b/Resource/Init/gs_ttf.ps
483aca
@@ -1421,7 +1421,7 @@ mark
483aca
           TTFDEBUG { (\n1 setting alias: ) print dup ==only
483aca
                 ( to be the same as  ) print 2 index //== exec } if
483aca
 
483aca
-          7 index 2 index 3 -1 roll exch //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
483aca
+          7 index 2 index 3 -1 roll exch .forceput
483aca
         } forall
483aca
         pop pop pop
483aca
       }
483aca
@@ -1439,7 +1439,7 @@ mark
483aca
           exch pop
483aca
           TTFDEBUG { (\n2 setting alias: ) print 1 index ==only
483aca
                      ( to use glyph index: ) print dup //== exec } if
483aca
-          5 index 3 1 roll //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
483aca
+          5 index 3 1 roll .forceput
483aca
           //false
483aca
         }
483aca
         {
483aca
@@ -1456,7 +1456,7 @@ mark
483aca
         {                            %  CharStrings(dict) isunicode(boolean) cmap(dict) RAGL(dict) gname(name) codep(integer) gindex(integer)
483aca
           TTFDEBUG { (\3 nsetting alias: ) print 1 index ==only
483aca
                 ( to be index: ) print dup //== exec } if
483aca
-          exch pop 5 index 3 1 roll //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
483aca
+          exch pop 5 index 3 1 roll .forceput
483aca
         }
483aca
         {
483aca
           pop pop
483aca
@@ -1486,7 +1486,7 @@ mark
483aca
       } ifelse
483aca
     ]
483aca
   TTFDEBUG { (Encoding: ) print dup === flush } if
483aca
-} bind def
483aca
+} .bind executeonly odef               % hides .forceput
483aca
483aca
 % to be removed 9.09......
483aca
 currentdict /postalias undef
483aca
diff --git a/Resource/Init/gs_type1.ps b/Resource/Init/gs_type1.ps
483aca
index 2935d9c..1f38dd7 100644
483aca
--- a/Resource/Init/gs_type1.ps
483aca
+++ b/Resource/Init/gs_type1.ps
483aca
@@ -116,7 +116,7 @@
483aca
                  {                                               % scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname aglname
483aca
                    CFFDEBUG { (\nsetting alias: ) print dup ==only
483aca
                          ( to be the same as glyph: ) print 1 index //== exec } if
483aca
-                   3 index exch 3 index //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
483aca
+                   3 index exch 3 index .forceput
483aca
                                                                  % scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
483aca
                  }
483aca
                  {pop} ifelse
483aca
@@ -135,7 +135,7 @@
483aca
          3 1 roll pop pop
483aca
      } if
483aca
      pop
483aca
-     dup /.AGLprocessed~GS //true //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
483aca
+     dup /.AGLprocessed~GS //true .forceput
483aca
    } if
483aca
 
483aca
    %% We need to excute the C .buildfont1 in a stopped context so that, if there
483aca
@@ -148,7 +148,7 @@
483aca
    {//.buildfont1} stopped
483aca
    4 3 roll .setglobal
483aca
    {//.buildfont1 $error /errorname get signalerror} if
483aca
- } bind def
483aca
+ } .bind executeonly def	% hide .forceput
483aca
 
483aca
 % If the diskfont feature isn't included, define a dummy .loadfontdict.
483aca
 /.loadfontdict where
483aca
-- 
483aca
2.20.1
483aca
483aca
483aca
From d683d1e6450d74619e6277efeebfc222d9a5cb91 Mon Sep 17 00:00:00 2001
483aca
From: Ray Johnston <ray.johnston@artifex.com>
483aca
Date: Sun, 24 Feb 2019 22:01:04 -0800
483aca
Subject: [PATCH 4/4] Bug 700585: Obliterate "superexec". We don't need it, nor
483aca
 do any known apps.
483aca
483aca
We were under the impression that the Windows driver 'PScript5.dll' used
483aca
superexec, but after testing with our extensive suite of PostScript file,
483aca
and analysis of the PScript5 "Adobe CoolType ProcSet, it does not appear
483aca
that this operator is needed anymore. Get rid of superexec and all of the
483aca
references to it, since it is a potential security hole.
483aca
---
483aca
 Resource/Init/gs_init.ps | 18 ------------------
483aca
 psi/icontext.c           |  1 -
483aca
 psi/icstate.h            |  1 -
483aca
 psi/zcontrol.c           | 30 ------------------------------
483aca
 psi/zdict.c              |  6 ++----
483aca
 psi/zgeneric.c           |  3 +--
483aca
 6 files changed, 3 insertions(+), 56 deletions(-)
483aca
483aca
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
483aca
index a054222..ca20f12 100644
483aca
--- a/Resource/Init/gs_init.ps
483aca
+++ b/Resource/Init/gs_init.ps
483aca
@@ -2485,24 +2485,6 @@ DELAYBIND not {
483aca
   systemdict /.forceundef .undef	% ditto
483aca
 } if
483aca
 
483aca
-% Move superexec to internaldict if superexec is defined. (Level 2 or later)
483aca
-systemdict /superexec known {
483aca
-  % restrict superexec to single known use by PScript5.dll
483aca
-  % We could do this only for SAFER mode, but internaldict and superexec are
483aca
-  % not very well documented, and we don't want them to be used.
483aca
-  1183615869 internaldict /superexec {
483aca
-    2 index /Private eq                % first check for typical use in PScript5.dll
483aca
-    1 index length 1 eq and    % expected usage is: dict /Private <value> {put} superexec
483aca
-    1 index 0 get systemdict /put get eq and
483aca
-    {
483aca
-      //superexec exec         % the only usage we allow
483aca
-    } {
483aca
-      /superexec load /invalidaccess signalerror
483aca
-    } ifelse
483aca
-  } bind cvx executeonly put
483aca
-  systemdict /superexec .undef % get rid of the dangerous (unrestricted) operator
483aca
-} if
483aca
-
483aca
 %% Can't remove this one until the last minute :-)
483aca
 DELAYBIND not {
483aca
 systemdict /.undef .undef
483aca
diff --git a/psi/icontext.c b/psi/icontext.c
483aca
index 1fbe486..7462ea3 100644
483aca
--- a/psi/icontext.c
483aca
+++ b/psi/icontext.c
483aca
@@ -151,7 +151,6 @@ context_state_alloc(gs_context_state_t ** ppcst,
483aca
     pcst->rand_state = rand_state_initial;
483aca
     pcst->usertime_total = 0;
483aca
     pcst->keep_usertime = false;
483aca
-    pcst->in_superexec = 0;
483aca
     pcst->plugin_list = 0;
483aca
     make_t(&pcst->error_object, t__invalid);
483aca
     {	/*
483aca
diff --git a/psi/icstate.h b/psi/icstate.h
483aca
index 4c6a14d..1009d85 100644
483aca
--- a/psi/icstate.h
483aca
+++ b/psi/icstate.h
483aca
@@ -54,7 +54,6 @@ struct gs_context_state_s {
483aca
     long usertime_total;	/* total accumulated usertime, */
483aca
                                 /* not counting current time if running */
483aca
     bool keep_usertime;		/* true if context ever executed usertime */
483aca
-    int in_superexec;		/* # of levels of superexec */
483aca
     /* View clipping is handled in the graphics state. */
483aca
     ref error_object;		/* t__invalid or error object from operator */
483aca
     ref userparams;		/* t_dictionary */
483aca
diff --git a/psi/zcontrol.c b/psi/zcontrol.c
483aca
index 0362cf4..dc813e8 100644
483aca
--- a/psi/zcontrol.c
483aca
+++ b/psi/zcontrol.c
483aca
@@ -158,34 +158,6 @@ zexecn(i_ctx_t *i_ctx_p)
483aca
     return o_push_estack;
483aca
 }
483aca
 
483aca
-/* <obj> superexec - */
483aca
-static int end_superexec(i_ctx_t *);
483aca
-static int
483aca
-zsuperexec(i_ctx_t *i_ctx_p)
483aca
-{
483aca
-    os_ptr op = osp;
483aca
-    es_ptr ep;
483aca
-
483aca
-    check_op(1);
483aca
-    if (!r_has_attr(op, a_executable))
483aca
-        return 0;		/* literal object just gets pushed back */
483aca
-    check_estack(2);
483aca
-    ep = esp += 3;
483aca
-    make_mark_estack(ep - 2, es_other, end_superexec); /* error case */
483aca
-    make_op_estack(ep - 1,  end_superexec); /* normal case */
483aca
-    ref_assign(ep, op);
483aca
-    esfile_check_cache();
483aca
-    pop(1);
483aca
-    i_ctx_p->in_superexec++;
483aca
-    return o_push_estack;
483aca
-}
483aca
-static int
483aca
-end_superexec(i_ctx_t *i_ctx_p)
483aca
-{
483aca
-    i_ctx_p->in_superexec--;
483aca
-    return 0;
483aca
-}
483aca
-
483aca
 /* <array> <executable> .runandhide <obj>				*/
483aca
 /* 	before executing  <executable>, <array> is been removed from	*/
483aca
 /*	the operand stack and placed on the execstack with attributes	*/
483aca
@@ -971,8 +943,6 @@ const op_def zcontrol3_op_defs[] = {
483aca
     {"0%loop_continue", loop_continue},
483aca
     {"0%repeat_continue", repeat_continue},
483aca
     {"0%stopped_push", stopped_push},
483aca
-    {"1superexec", zsuperexec},
483aca
-    {"0%end_superexec", end_superexec},
483aca
     {"2.runandhide", zrunandhide},
483aca
     {"0%end_runandhide", end_runandhide},
483aca
     op_def_end(0)
483aca
diff --git a/psi/zdict.c b/psi/zdict.c
483aca
index b0deaaa..e2e525d 100644
483aca
--- a/psi/zdict.c
483aca
+++ b/psi/zdict.c
483aca
@@ -212,8 +212,7 @@ zundef(i_ctx_t *i_ctx_p)
483aca
     int code;
483aca
 
483aca
     check_type(*op1, t_dictionary);
483aca
-    if (i_ctx_p->in_superexec == 0)
483aca
-        check_dict_write(*op1);
483aca
+    check_dict_write(*op1);
483aca
     code = idict_undef(op1, op);
483aca
     if (code < 0 && code != gs_error_undefined) /* ignore undefined error */
483aca
         return code;
483aca
@@ -504,8 +503,7 @@ zsetmaxlength(i_ctx_t *i_ctx_p)
483aca
     int code;
483aca
 
483aca
     check_type(*op1, t_dictionary);
483aca
-    if (i_ctx_p->in_superexec == 0)
483aca
-        check_dict_write(*op1);
483aca
+    check_dict_write(*op1);
483aca
     check_type(*op, t_integer);
483aca
     if (op->value.intval < 0)
483aca
         return_error(gs_error_rangecheck);
483aca
diff --git a/psi/zgeneric.c b/psi/zgeneric.c
483aca
index 8048e28..d4edddb 100644
483aca
--- a/psi/zgeneric.c
483aca
+++ b/psi/zgeneric.c
483aca
@@ -204,8 +204,7 @@ zput(i_ctx_t *i_ctx_p)
483aca
 
483aca
     switch (r_type(op2)) {
483aca
         case t_dictionary:
483aca
-            if (i_ctx_p->in_superexec == 0)
483aca
-                check_dict_write(*op2);
483aca
+            check_dict_write(*op2);
483aca
             {
483aca
                 int code = idict_put(op2, op1, op);
483aca
 
483aca
-- 
483aca
2.20.1
483aca